Skip to content

Commit

Permalink
Prevent a ReDoS vulnerability (#335)
Browse files Browse the repository at this point in the history
fix: prevent a ReDoS vulnerability

Ported from markdown-it/markdown-it@89c8620.

fix: prevent ReDoS with comments

Once again - prior art: markdown-it/markdown-it@6ab7cc3

Hat tip @DanCech #335 (comment) for pointing out #331 (comment), which I missed initially
  • Loading branch information
dominykas authored and TrySound committed Jul 29, 2019
1 parent 49e87b7 commit 287dfbf
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 2 deletions.
4 changes: 2 additions & 2 deletions lib/common/html_re.js
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,10 @@ var open_tag = replace(/<[A-Za-z][A-Za-z0-9]*attribute*\s*\/?>/)
();

var close_tag = /<\/[A-Za-z][A-Za-z0-9]*\s*>/;
var comment = /<!--([^-]+|[-][^-]+)*-->/;
var comment = /<!---->|<!--(?:-?[^>-])(?:-?[^-])*-->/;
var processing = /<[?].*?[?]>/;
var declaration = /<![A-Z]+\s+[^>]*>/;
var cdata = /<!\[CDATA\[([^\]]+|\][^\]]|\]\][^>])*\]\]>/;
var cdata = /<!\[CDATA\[[\s\S]*?\]\]>/;

var HTML_TAG_RE = replace(/^(?:open_tag|close_tag|comment|processing|declaration|cdata)/)
('open_tag', open_tag)
Expand Down
11 changes: 11 additions & 0 deletions test/fixtures/remarkable/redos.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
.
<a>ReDoS</a><![CDATA[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]] >
.
<p><a>ReDoS</a>&lt;![CDATA[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]] &gt;</p>
.

.
<a>z</a><!--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa--->
.
<p><a>z</a>&lt;!–aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa—&gt;</p>
.

0 comments on commit 287dfbf

Please sign in to comment.